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I. Overview 

Robustness of routing policies for networks is a central problem which is gaining increased 
attention with a growing awareness to safeguard critical infrastructure networks against natural 
and man-induced disruptions. Routing under limited information and the possibility of cascades 
through the network adds serious challenges to this problem. This abstract considers the frame- 
work of dynamical networks introduced in our earlier work flU, 0, where the network is modeled 
by a system of ordinary differential equations derived from mass conservation laws on directed 
acyclic graphs with a single origin-destination pair and a constant inflow at the origin. The rate 
of change of the particle density on each link of the network equals the difference between the 
inflow and the outflow on that link. The latter is modeled to depend on the current particle density 
on that link through a flow function. The novel modeling element in this abstract is that every 
link is assumed to have finite capacity for particle density and that the flow function is modeled 
to be strictly increasing as density increases from zero up to the maximum density capacity, 
> and is discontinuous at the maximum density capacity, with the flow function value being zero 

at that point. This feature, in particular, allows for the possibility of spill-backs in our model, 
which was absent from the model considered in [HI, 0. In this extended abstract, we present 
our results on resilience of such networks under distributed routing, towards perturbations that 

IT") reduce link- wise flow functions. 

O 

t-h II. Model formulation 

For the sake of this abstract, we consider the following simple scenario. The topology of the 
network is abstracted as an acyclic directed graph T = (V, £) with one origin/destination pair and 
such that every node lies on a path from the origin to the destination. If e = (v, w) G £ is a link, 
we shall write a(e) = v and r(e) = w for its tail and head node, respectively. Acyclicity implies 
that we can identify the node set V = {0, 1, . . . , n} in such a way that cr(e) < r(e) for all e £ £, 
so that in particular is the origin and n the destination. The sets of outgoing and incoming links 
of a node v G V will be denoted by £+ := {e E £ : a(e) = v} and £~ := {e G £ : r(e) = v }, 
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respectively. The state of the network is described by a vector p = {p e : e G £}, where p e denotes 
the density on link e. The flow on link e is given by the functional relationship f e = p e {p e )- 
We assume that the flow function p e : [0, p™ ax ] — >■ IR + is continuous differentiable and strictly 
increasing on [0, p™ ax ), and is such that p e (0) = /i e (p™ ax ) = 0. Here, p™ ax > stands for the 
density capacity on link e. We let T : = x egf [0, pf ax ) be the state space, and the maximum 
flow capacities be / e max := lim Pe1v ,max p e {p e ) for all e £ £. We shall write p := {p e : e G £} 
for the vector of flow functions. If p := {p e : e G £} is another flow function vector with the 
same properties, an inequality p > p will have to be interpreted component-wise. The way the 
inflow of a node v < n gets split among its outgoing links is determined by the routing policy 
Q := {G v : r„ — > S v } < v<n , where T v := x eg£ .+ [0, p™ ax ), and S v stands for the simplex of 
probability vectors over £+. In particular, we focus on the class of locally responsive distributed 
routing policies, which is a family of continuously differentiable distributed routing functions 
Q = {G v : T v — > S v } v( z\; such that, for every non-destination node < v < n: 

(a) for every nonempty proper subset J C £+, there exists a continuously differentiable 
map G J : Tj Sj, where Kj := R%, Tj := {p G TZj \ p e < p™ x Ve G J}, and 
Sj '■= {p £ Tlj '■ J2jejPj — 1} is tne simplex of probability vectors over J, such 
that, for every x J G Tj, if 

x e ->• p^ ax , Ve G £+ \ J , Xj -> xf G Tj- , Vj G J , then 
G^(ar) -> 0, Ve G f + \ J , G){x) Gf VjeJ. 

(b) ^GJ(x) > , Vj, e G C , e , x G r„ , 

The two salient features of this routing policy are the local information constraint which 
allows the routing policy G"(p v ) to depend only on the particle density p v on the set of 
outgoing links of the non-destination node v, and the condition (a), which models the fact that 
no flow can be routed to a fully congested link. The additional condition (b) is a rather natural 
in that it states that the faction of particles routed towards any link does not decrease when the 
particle density in some other link is increased. It is reminiscent of the notion of cooperative 
dynamical system. In fact, routing policies with this property were proven to be optimal in terms 
of resilience in the our earlier work on dynamical networks with infinite density capacity [[TJ, 

We are now ready to describe the dynamical network model used in this abstract. Consider 
a flow network over T with a constant inflow A > at the origin and the flows on the links 
evolving according to the following dynamical system with pit) G cl(T) as the state vector: 

Ap e (t) = X(T[e) {t)X a{e) {t)G^ (p«*\t)) - Xr(e)(t)fe(t) , (D 

for all e G £, where G v are the locally responsive routing policies, /(£) = p{p(t)) and X v (t) 
is the incoming flow at node v G V and is equal to Ao if v = and equal to J2 e e£~ fe(t) if 
v > 0, while Xv(t) := 1 — lleGf + (^ — €e(t)) and £ e (t) := l[ 0tf) m^(p e (t)) are the activation status 
indicators of a node v G V and a link e G £. In this abstract, we use dynamical network to refer 
to the dynamics ([TJ) with locally responsive routing policies Q. 

Equation ([TJ) states that the rate of change of the particle density on a link e outgoing from 
some non-destination node v is given by the difference between \ v {t)G" e (p v (t)), i.e., the portion 
of the total outflow at node v which is routed to link e, and f e {t), i.e., the particle flow on link e. 
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The set of such equations model conservation of mass both at every non-destination node and on 
the links of the flow network. In particular, when Xv(t) — 0, no flow can be absorbed by any of 
the outgoing links of node v, and Q implies that no flow comes out of any of the incoming links 
of node v. Observe that the distributed routing policy G v (p v ) induces a local feedback which 
couples the dynamics of the particle flow on the different links. In fact, the dynamical network 
([T]) should be interpreted as an |£ (-dimensional switched system. Existence and uniqueness of a 
solution for every initial density p(0) G cl(T), then follow from the differentiability assumptions 
on the flow function p and the routing policy Q by standard arguments. 

The most novel feature of the dynamics Q resides in the role of the link and node activation 
status indicators £ e (t), and Xv(t)- Indeed, observe that, if £ e (i*) = for some t* , then £ e (t) = 
for all t > t*. This is a direct consequence of the fact that \ a ^ e ){t)G v e {p") — p e (p e ) = whenever 
p e = p™ ax . Once the particle density reaches its maximum capacity on a link, the corresponding 
outflow is zero, and the link becomes irreversibly inactive. On the other hand, the definition of 
indicator variables implies that a node becomes inactive, or fails, when all the outgoing links 
do so, and thus it remains inactive ever since. In turn, this drops the outflow of all its incoming 
links to zero so that they are bound to become inactive. As a consequence some other links may 
experience an overload, possibly reaching their density capacity, thus becoming inactive ever 
since. Through this mechanism, link and node failures can propagate through the network. 

The following proposition states a fundamental dichotomy in the behavior of the dynamical 
network: either all the asymptotic time-averaged outflow equals the constant inflow, or it is zero. 
Such a dichotomy is a direct consequence of the boundedness of the density capacities. 

Proposition 1. For any initial density vector p(0) G cl(T), either of the following alternatives 
hold: 

1 f f If 1 

lim - / A n (s)ds = Ao, or Urn - / A n (s)ds = 0. (2) 

t— >oo t Jo t— >oo t Jo 

Motivated by this, we define the dynamical network to be transferring with respect to some 
initial density vector p(0) G cl(T) if the first condition in §2§ holds. We consider persistent 
perturbations of the dynamical network ([T|) that reduce the flow functions on the links. Formally, 
an admissible perturbation of a dynamical network is a network with the same topology T, same 
locally responsive distributed routing policies Q = {G v : T v — > S v } ve \> and a family of perturbed 
flow functions p := {p e : [0,p™ ax ] — > IR + } e6 £ that have the same monotonicity and differentiable 
properties as /x, and are such that, for every e G £, p e (Pe) < Pe(p e ), for all p e G [0, p™ ax ]. We 
accordingly let /™ ax := lim Pe ^ p max p e (p e ). The perturbed dynamical network is then governed by 

^Pe(i) = Ue)(t)K(e)(t)G^ (p* B > (*)) - Xr(e) (*) fe (*) , (3) 

for all e G £, where f(t) = p(p(t)) and X v (t) is equal to A if v — and equal to J2 e e£~ f^) 
if v > 0, while Xvif) ■— 1 — Il ee£ +(^ - ie(t)) and f e (t) := l[ 0iP ™*)(p e (t)) for all v G V. Note 
that the routing policy Q used in ([j) and ([3]) are the same. 

The magnitude of an admissible perturbation is defined as \\5\\i = J2 e es^ e ' where 5 G 
, 5 e := sup Peg r 0)P maxi {pL e {p e ) — /i e (p e )} , e G £ . The margin of resilience of the dynamical 
network 7(p°) is defined as the infimum magnitude of all the admissible perturbations for which 
the perturbed dynamical network is not transferring with respect to the initial density vector 
p(0) = p° . In the next section, we report our results on the margin of resilience. 
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III. Results 

We start by stating an upper bound on the margin of resilience of a dynamical network. 
Throughout, we shall assume that p° is an equilibrium for the unperturbed dynamical net- 
workQ with the corresponding flow f° = /x(p°), i.e., AoGg(p°) = f° for all e G £q and 
(Seef- fl) G l(P°) = fe for a11 e e £ v wnen ^ > 0. We shall also assume that the topology 
T is tree-like. By this, we mean that the only node reachable from the origin by two distinct 
paths is the destination one. The assumption of tree-likeness of the topology implies that one 
can partition the node set as V = Uo<j<j* V? u i n } > where V 3 ■ := {0 < v < n : dist(0, v) = j} 
is the set of non-destination nodes at distance j from the origin, and j* is the maximal distance 
of a non-destination node from the origin. 

Before proceeding we introduce here some preliminary notation. Let us introduce the residual 
capacity R v (f°) := J2 ee£ + f™ ax — fl , of a non-destination node < v < n, and let R(f°) : = 
mm{i?„(/°) : < v < n} be the minimal node residual capacity of the network. For an inflow 
Ao > 0, we shall consider the set of equilibrium flows 

^(A„) := {/ 6 * : £ eect /. = *.. E e6£ , /• = E ee£l7 /• • V0 < « < "} ■ 

An origin-destination cut is a subset U C V such that eU and n £U. For an origin-destination 
cut W, let £j| := {e E £ : cr(e) G U,r(e) U} be the set of links with tail node in W and 
head node in V \ W, and let C(U) := J2 e es + /e max be its capacity. The min-cut capacity of the 
flow network is C := min u C(U) , where the minimization runs over all the origin-destination 
cuts. By the min-cut max-flow theorem it follows that .F(Ao) ^ if and only if C(J\f) > Ao, a 
condition that we shall assume in order to avoid trivialities. 

(a) We now describe a procedure to compute an upper bound on the margin of resilience. For 
every non-destination node < v < n, and A > 0, define 

X v {\) .= [x e X e [0, AH : J2 e (^ maX " < ^} ■ 

where the product/sum index e runs over f +. Further, let d n = +oo. For j = j*, j* — 1, . . . , 0, 
iteratively define 

d v := min {c„(a;) : x G ^(A°)} , A° := E e6£ + ^° ' 

for all v G Vj, where c v (x) := X] e e£' + Kiinj^e, c?T(e)} • The intuition behind this definition is the 
following: c v (x) is the cost that a hypothetical malicious adversary has to face in order to reduce 
the sum of the maximal flow capacities of the outgoing links of a node v below the inflow A°, 
thus causing the eventual link's failure. In order to compute such cost, for every outgoing link 
e, the minimum between the flow capacity reduction x e and the previously computed cost to 
induce a failure of the head node r(e) is considered. 

The following result states an upper bound on the margin of resilience in terms of the 
calculations described above. 



'The conditions for existence and uniqueness of equilibrium follows from our prior work 1 1 1 on dynamical flow networks 
with unbounded density capacities. 
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Theorem 1 (Upper bound on the margin of resilience). Assume that the network topology T is 
tree-like, and that the dynamical network has an equilibrium density vector p°. Then, the margin 
of the resilience is upper bounded as: j(p°) < d . 

The following proposition gives useful bounds on the the quantity do. 

Proposition 2. Let f° = /i(p°) G ^(Ao) be an equilibrium flow for the dynamical network. 
Then, R(f°) < d < C - A . 

Proposition [2] and Theorem [T] imply that the margin of resilience is upper bounded by the 
network residual capacity C — Ao- In fact, one can show examples where the margin of resilience 
is strictly less than C — A . In 0], we showed that the margin of (weak) resilience is equal to 
C when there is no bound on the density capacity. This illustrates the loss in resilience due to 
finiteness of density capacities. 

(b) In [2J, we computed margin of strong resilience of a dynamical network when there is no 
bound on the maximum particle density on the links, and the flow functions are monotonically 
increasing. The margin of strong resilience is defined to be the infimum magnitude of all 
admissible perturbations for which (analogous to the definition of margin of resilience in this 
abstract) the outflow from the destination node of the perturbed dynamical network is not 
asymptotically equal to A . In particular, we showed that the margin of strong resilience in 
that setting is equal to the minimum node residual capacity of the network R(f°). We show 
that, when the links have finite capacity for particle densities as in this abstract, the margin of 
resilience could be possibly greater than the minimum node residual capacity. We illustrate this 
point through the following example. 

Consider the topology shown in Figure [T] 
Let the flow functions p be such that: /™ ax = 
3, /™ x = 1.5, /™ x = /™ x = 0.75. 1 Let 
the equilibrium flows be: f° = f° = 1 
and f° = f° 4 = 0.5. The min node resid- 
ual capacity with these parameters is 0.5. 
We now show that, if nodes and 1 are 
implementing locally responsive distributed 
routing policy, then even with a disturbance 

Fig. 1. A sample network topology. Qf magnitude Q g > then netW Ork is 

still transferring. First, consider a specific 
disturbance of magnitude 0.6 under which the perturbed flow functions are: p ei = p ei , p £2 = p e2 , 
~p ez = 3/i e3 /5 and fl e4 = 3pj5. For the perturbed network, /™ x + /™ x = 0.9 < 1 = / e ° 3 + /£. 
Therefore, after a finite time, both p e3 (t) and p e4 (t) hit the respective maximum capacity on 
particle densities, at which point xi becomes zero. As a consequence the outflow term for link 

62 becomes zero after this time. If the routing policy G at node has property that G\ (p~ v ) — > 
if p e2 — > p™ ax , the inflow of 2 at node is routed to link e\ and hence the network maintains its 
transferring property. In general, for any other disturbance of magnitude 0.6, in the worst-case, 
the inflow to node 1 would be such that it could exceed the sum of perturbed capacities of links 

63 and e4 and hence making x% — 1> a fter which one can repeat the argument to show that all 
the inflow of 2 at node is transferred to link e\ and the network maintains its transferring 
property. 

This example shows that spill-backs act as backward propagators of information to upstream 
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routing policies (in this example, the local routing policy at node gets information about links 
e 3 and e 4 through spill-backs). Since having information about downstream links by routing 
policies increases resilience, spill-back cascades lead to an increase in the margin of resilience 
of dynamical networks. 

IV. Conclusion 

In this paper, we studied resilience of capacitated dynamical networks, where the links have 
finite capacity for flow density, thereby allowing the possibility of spill-back cascades. We studied 
the effect of such cascades on the resilience of the network and provided an algorithm to compute 
an upper bound on the margin of resilience of the network for tree-like topologies. Future work 
will involve performing analysis for general acyclic and cyclic topologies, possibly with multiple 
origin-destination pairs. 
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